CGM CLININET contains a code injection weakness in the ConvExpr function, which processes Perl expressions into RTF document content. The function does not properly control the code derived from these expressions, allowing an attacker who can authenticate as a high‑privileged user to supply arbitrary Perl code that is executed with root privileges.

The flaw targets the CGM CLININET product. Versions up to 2026.MS3 are confirmed to be vulnerable, and later releases may also be affected.

The CVSS score of 8.6 signals a high‑severity vulnerability that can lead to complete system compromise. EPSS information is not available, and the issue is not listed in the CISA KEV catalog, so no public exploit data exists at this time. However, the attacker must first obtain authentication as a high‑privileged account; once that condition is met, the attacker can inject and execute arbitrary code, effectively taking full control of the host. The potential damage is catastrophic, warranting immediate assessment and mitigation.